AU2004324546B2

AU2004324546B2 - Secure authenticated channel

Info

Publication number: AU2004324546B2
Application number: AU2004324546A
Authority: AU
Inventors: Jean Pierre Andreaux; Alain Durand; Thomas Sirvent
Original assignee: Thomson Licensing
Priority date: 2004-10-29
Filing date: 2004-10-29
Publication date: 2009-12-24
Anticipated expiration: 2024-10-29
Also published as: JP4719749B2; ATE477636T1; DE602004028670D1; AU2004324546A1; KR20090119791A; KR20070070198A; BRPI0419162A; CN101048970B; EP1805929B1; CN101048970A; KR101075316B1; KR101075334B1; EP1805929A1; RU2009102230A; MX2007005037A; JP2008518530A; ES2348240T3; WO2006048043A1; RU2488226C2

Abstract

A protocol (i.e. method) and corresponding apparatuses for calculating a session key. Two peers with knowledge of a common Diffie-Hellman permanent key, Kperrn, and the identity and public key of the other peer. A first peer chooses a first ephemeral private key x and calculates the first corresponding ephemeral public key gx, which is sent to the second peer. The second peer calculates a second ephemeral public key gy in the same manner, and an ephemeral shared key Keph, hashes gy, Keph, Kperm, and its identity, and sends gy and the hash to the first peer. The first peer calculates Keph, verifies the hash, and hashes gx, Keph, Kpem, and its identity, and sends it to the second peer that verifies this hash. Thereafter, both peers obtain a session key by hashing Keph. The apparatuses may then use the session key to establish a secure authenticated channel (SAC).

Description

WO 2006/048043 PCT/EP2004/052722 SECURE AUTHENTICATED CHANNEL [0001] The invention relates generally to secure authenticated channels, and in particular to calculation of session keys for establishment of such channels for protection of digital content, for example in a digital television system. 5 [0002] Secure authenticated channels, well known in the art of cryptography, are established to allow two mutually authenticated devices (often called peers) to exchange information confidentially. A secure authenticated channel should preferably have the following characteristics: - mutual authentication of the peers; 10 - key confirmation, i.e. a common secret is established and at least one peer is able to verify that the secret indeed is common; - forward secrecy, i.e. old session keys cannot be calculated even when long-term secret keys (such as certificate secret keys) are known. [0003] These characteristics can be formally proven mathematically, and it 15 has been proven that if there exists a way to circumvent one of the above characteristics for a given cryptographic protocol, then the whole protocol may be broken with relative ease. [0004] Over the years, the cryptographic community has proposed many protocols for secure authenticated channels. Only a few of these channels 20 have been proven to fulfill the characteristics above. [0005] The protocols that do provide channels with the required characteristics all use a number of different cryptographic primitives: at least one asymmetric primitive (such as asymmetric encryption or digital signature), hash functions, Message Authentication Code (MAC), and, in 25 some of them, other primitives such as symmetric encryption. A problem with these protocols is that they are quite resource consuming and are as such difficult to implement in a device with limited computing capabilities, such as for example a portable security module, like a smart card. Another problem is that the use of many cryptographic primitives makes it difficult to prove that a 30 protocol is secure.

(0005a] Any discussion of documents, acts, materials, devices, articles or the like which has been included in the present specification is solely for the purpose of providing a context for the present invention. It is not to be taken as an admission that any or all of these matters form part of the prior art base or were common 5 general knowledge in the field relevant to the present invention as it existed before the priority date of each claim of this application. [0005b] Throughout this specification the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element, integer or step, or group of elements, integers or steps, but not the 10 exclusion of any other element, integer or step, or group of elements, integers or steps. [0006] The present invention provides a secure access channel protocol that has the required characteristics and that is particularly suitable for implementation in a device with limited computing capabilities. 15 [0007] Throughout the description, it will be assumed that, as cryptography is a mature art, the basic concepts are well known. These concepts will for reasons of clarity and succinctness not be described more than necessary for the comprehension of the invention. SUMMARY OF THE INVENTION !0 [0008] In a first aspect, the invention is directed to a method of calculating a session key common to a first and a second device (11, 21). The first device has a certificate (Ca) comprising a public key (ga) and an identity corresponding to itself (IDa), and knowledge of the identity corresponding to itself (IDa), a private key (a), and the public key (ga). The second device has a corresponding certificate and knowledge. 25 The first device chooses a first ephemeral private key (x), calculates a first ephemeral public key (gx), and sends its certificate (Ca) and the first ephemeral public key (gx) to the second device. Upon reception of the certificate of the first device (Ca) and the first ephemeral public key (gx), the second device verifies the certificate of the first device(Ca), chooses a second ephemeral private key (y), calculates a second 30 ephemeral public key (gY), calculates an ephemeral shared key (Keph) from the first ephemeral public key (gx) and the second ephemeral private key (y), calculates a permanent key (Kperm,) from the public key of the first device (ga) and its own private key (b), calculates a first value (H(gy, Keph, Kperm, IDb)) from the second ephemeral 2a public key (gY), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDb), and sends its certificate (Cb), the second ephemeral public key (gY) and the first value (H(gy, Keph, Kperm, IDb)) to the first device. Upon reception of the certificate of the second device (Cb), the second 5 ephemeral public key (gY) and the first value (H(gy, Keph, Kperm, IDb)) from the second device, the first device verifies the certificate of the second device(Cb), calculates the ephemeral shared key (Keph) from the second ephemeral public key (gY) and the first ephemeral private key (x), calculates the permanent key (Kperm) from the public key of the first device (gb) and its own private key (a), verifies the 2b WO 2006/048043 PCT/EP2004/052722 first value (H(gy, Keph, Kperm, IDb)), calculates a second value (H(gx, Keph, Kperm, IDa)) from the first ephemeral public key (g'), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDA), and sends the second value (H(gx, Keph, Kperm, IDa)) to the second 5 device. Upon reception of the second value (H(gx, Keph, Kperm, IDa)), the second device verifies the second value (H(gx, Keph, Kperm, IDa)), and calculates a session key (Ksess) as a function of the epheme ral shared key (Keph). The first device also calculates the session key (Ksese) as a function of the ephemeral shared key (Keph). 10 [0009] In a second aspect, the invention is directed to a first device (11) for participating, with a second device (21), in the calculation of a session key. The first device has a certificate (C.) comprising a public key (go) and an identity corresponding to itself (ID 8 ), and knowledge of the identity corresponding to itself (IDa), a private key (a), and the public key (ga). The 15 first device comprises a processor (12) for choosing an ephemeral private key (x); calculating a first ephemeral public key (gx); sending its certificate (Ca) and the first ephemeral public key (gx) to the second devi Ce; receiving a certificate of the second device (Cb), a second ephemeral public key (gY) and a first value (H(gy, Keph, Kperm, IDb)) from the second device, the certificate 20 (Cb) comprising a public key (gb) and an identity of the second device (IDb), and the first value (H(gy, Keph, Kperm, IDb)) being calculated from the second ephemeral public key (gY), an ephemeral shared key (Keph), a permanent key (Kperm), and the identity corresponding to the second device (IDb); verifying the certificate of the second device(Cb); calculating the ephemeral shared 25 key (Keph) from the second ephemeral public key (gY) and the ephemeral private key (x); calculating the permanent key (Kperm) from the public key of the first device (gb) and its own private key (a); verifying the first value (H(gy, Keph, Kperm, IDb)); calculating a second value (H(gx, Keph,-Kperm, IDa)) from the first ephemeral public key (gX), the ephemeral shared key (Keph), the 30 permanent key (Kperm), and the identity corresponding to itself (IDa); sending the second value (H(gx, Keph, Kperm, IDo)) to the second device; and 3 WO 2006/048043 PCT/EP2004/052722 calculating a session key (Ksess) as a function of the ephemeral shared key (Keph). [0010] In a third aspect, the invention is directed to a second device (21) for participating, with a first device (11), in the calculation 5 of a session key. The second device has a certificate (Cb) comprising a public key (gb) and an identity corresponding to itself (IDb), and knowledge of the identity corresponding to itself (IDb), a private key (b), and the public key (gb). The second device comprises a processor (22) for receiving a certificate of the first device (Ca) and a first ephemeral public key (gX), the certificate 10 comprising a public key (ga) and an identity of the first device (IDa); verifying the certificate of the first device (Ca); choosing an ephemeral private key (y); calculating a second ephemeral public key (gY); calculating an ephemeral shared key (Keph) from the first ephemeral public key (gx) and the ephemeral private key (y); calculating a permanent key (Kperm) from the public key of the 15 first device (ga) and its own private key (b); calculating a first value (H(gy, Keph, Kperm, IDb)) from the second ephemeral public key (gY), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDb); sending its certificate (Cb), the second ephemeral public key (gY) and the first value (H(gy, Keph, Kperm, IDb)) to the first device; receiving a 20 second value (H(gx, Keph, Kperm, IDa)) from the first device, the second value being calculated from the first ephemeral public key (gx), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to the first device (IDa); verifying the second value (H(gx, Keph, Kperm, IDa)); and 25 calculating the session key (Keess) as a function of the ephemeral shared key (Keph). [0011] Figure 1 illustrates the session key exchange according to an embodiment of the-present invention; [0012] Figure 1 illustrates the session key exchange according to an 30 embodiment of the present invention. [0013] Before the start of the method, the first device 11 knows its identity IlDa, its own private key a and public key ga. ga is a short notation for ga mod 4 WO 2006/048043 PCT/EP2004/052722 p, where a is the first device's private key, g is a known generator and p is a known prime number, as is well known in the art. The second device 21 has the corresponding knowledge: IDb, b, g . Certificates for the devices comprise the public key and the identity; Ca(ga, IDa) and Cb(gb, IDb), respectively. The 5 devices 11, 12 also have processors (CPU) 12, 22 adapted to effect the steps of the method. [0014] In step 252, the first device 11 chooses, preferably randomly, a first ephemeral private key x and calculates an ephemeral public key gx, that it sends together with its certificate Ca(ga, IDa) to the second device 21 in 10 message 254. [0015] Upon reception of message 254, the second device 21 verifies the certificate Ca(ga, IDa) of the first device 11; step 256. If the verification is unsuccessful, the second device 21 abandons the method. However, if the verification is successful, then it chooses, preferably randomly, a second 15 ephemeral private key y, and calculates a second ephemeral public key gY, a ephemeral shared key Keph = g (, and a Diffie-Hellman permanent key Kprm = ab ga, in step 258. [0016] In step 260, the second device 21 then calculates a first hash value H(gy, Keph, Kparm, IDb) using the second ephemeral public key gY, the 20 ephemeral shared key Keph, the Diffie-Hellman permanent key Kperm, and its identity IDb, and a suitable hash function, for example one of the many functions known in the art. It should be known that other suitable functions than hash functions may be used for this and the following hash value calculations of the embodiment. The second device 21 then sends the 25 second ephemeral public key gy, its certificate Cb(gb, IDb), and the first hash value H(gy, Keph, Kperm, IDb) to the first device 11 in message 262. [0017] Upon reception of message 262, the first device 11 verifies the certificate Cb(gb, IDb) of the second device 21; step 264. If the verification is unsuccessful, the first device 11 abandons the method. However, if the 30 verification is successful, the first device 11 computes the ephemeral shared key Keph and the Diffie-Hellman permanent key Kperm in step 266. In step 268, the first device 11 verifies the first hash value, using the same hash function 5 WO 2006/048043 PCT/EP2004/052722 as the second device 21 used in step 260. If the first hash value is not verified, then the first device 11 aborts the method, but if the first hash value is verified, then the first device 11 calculates a second hash value H(gx, Keph, Kperm, IDa) in step 270, using the first ephemeral public key gx, the ephemeral 5 shared key Keph, the Diffie-Hellman permanent key Kperm and its identity IDa. The first device 11 sends the second hash value H(gx, Keph, Kperm, IDa) to the second device 21 in message 272. [0018] Upon reception of the message 272, the second device 21 verifies the second hash value H(gx, Keph, Kperm, IDa) in step 274, using the same hash 1o function as the one used by the first device 10 in step 270. If the second hash value is not verified, then the second device 21 aborts the protocol, but if the second hash value is verified, then the second device 21 calculates, in step 276, a session key Ksess by calculating the hash value of the ephemeral shared key Keph. Then it sends a "ready" message 278 to the first device 11 15 to indicate that the second hash value H(gx, Keph, Kperm, IDa) has been successfully verified and the session key Ksess has been calculated. [0019] Upon reception of the "ready" message 278 from the second device 21, the first device 11 calculates, in step 280, the same session key Ksess by calculating the hash value of the ephemeral shared key Keph, using the same 20 hash function as that used by the second device 21 in step 276. Then the first device 11 sends a "ready" message 282 to the second device 21 to indicate that it too has calculated the session key Ksess. [0020] At this point, both the first device 11 and the second device 21 possess the session key Ksess that can be used to protect information sent 25 between them. With the protocol according to the invention, the confidentiality of the private keys is assured, the authentication and the key confirmation are mutual. Furthermore, the forward secrecy and the robustness against leakage of previous session key are assured as well. A person skilled in the art will appreciate that the three hash functions 30 described in connection with steps 212, 220, and 226 may be different, the same, or that two of them are the same while the third is different. 6 WO 2006/048043 PCT/EP2004/052722 [0021] It should be noted that where this description makes reference to random numbers, these numbers are often in practice pseudo-random. [0022] The expression "security module" encompasses any kind of security module, portable or stationary, that comprises a processor and can be used 5 to establish a secure authenticated channel according to the invention, such as for example smart cards, PC cards (formerly known as PCMCIA cards), and integrated circuits soldered to the Printed Circuit Board of an apparatus such as a television. [0023] The embodiment described hereinbefore is particularly suited for io implementation in a digital television set and a security module. However, a person skilled in the art will appreciate that the invention may be implemented and used by any kind of device with the necessary resources, i.e. a processor and preferably a memory storing the necessary information. Non-limitative examples of other devices are DVD players, computers 15 interacting with external accessories, and Automatic Teller Machines (ATMs) and bankcards. 7

Claims

1. A method of calculating a session key shared by a first and a second device, the first device having a certificate (Ca) comprising a public key (ga) and an 5 identity corresponding to itself (IDa), and knowledge of the identity corresponding to itself (IDa), a private key (a), and the public key (ga) the second device having a certificate (Cb) comprising a public key (gb) and an identity corresponding to itself (IDb), and knowledge of the identity corresponding to itself (IDb), a private key (b), and the public key (gb), 10 the method comprising the steps of: at the first device: - choosing a first ephemeral private key (x); - calculating a first ephemeral public key (gx); - sending its certificate (Ca) and the first ephemeral public key (g') to the 15 second device; at the second device: - receiving the certificate of the first device (Ca) and the first ephemeral public key (gx); - verifying the certificate of the first device(Ca); 20 - choosing a second ephemeral private key (y); - calculating a second ephemeral public key (gY); - calculating an ephemeral shared key (Keph) from the first ephemeral public key (gx) and the second ephemeral private key (y); - calculating a permanent key (Kperm) from the public key of the first device 25 (ga) and its own private key (b); - calculating a first value (H(gy, Keph, Kperm, IDb)) from the second ephemeral public key (gY), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDb); - sending its certificate (Cb), the second ephemeral public key (gY) and the 30 first value (H(gy, Keph, Kperm, IDb)) to the first device; at the first device: - receiving the certificate of the second device (Cb), the second ephemeral public key (gY) and the first value (H(gy, Keph, Kperm, IDb)) from the second device; 35 - verifying the certificate of the second device(Cb); - calculating the ephemeral shared key (Keph) from the second ephemeral public key (gY) and the first ephemeral private key (x); - calculating the permanent key (Kperm) from the public key of the second device (gb) and its own private key (a); 5 - verifying the first value (H(gy, Keph, Kperm, 1Db)); - calculating a second value (H(gx, Keph, Kperm, IDa)) from the first ephemeral public key (gX), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDa); - sending the second value (H(gx, Keph, Kperm, IDa)) to the second device; 10 at the second device: - receiving the second value (H(gx, Keyh, Kperm, IDa)); - verifying the second value (H(gx, Keph, Kperm, IDa)); and - calculating a session key (Ksess) as a function of the ephemeral shared key (Keph); and 15 at the first device: - calculating the session key (Ksess) as a function of the ephemeral shared key (Keph).

2. A first device for participating, with a second device, in the calculation of a 20 shared session key, the first device having a certificate (Ca) comprising a public key (ga) and an identity corresponding to itself (IDa), and knowledge of the identity corresponding to itself (IDa), a private key (a), and the public key (ga), the first device comprising a processor for: - choosing an ephemeral private key (x); 25 - calculating a first ephemeral public key (gx); - sending its certificate (Ca) and the first ephemeral public key (gx) to the second device; - receiving a certificate of the second device (Cb), a second ephemeral public key (gY) and a first value (H(g , Keph, Kperm, IDb)) from the second device, the 30 certificate (Cb) comprising a public key (gb) and an identity of the second device (IDb), and the first value (H(gy, Keph, Kperm, IDb)) being calculated from the second ephemeral public key (gY), an ephemeral shared key (Keph), a permanent key (Kperm), and the identity corresponding to the second device (IDb); 35 - verifying the certificate of the second device(Cb); 9 - calculating the ephemeral shared key (Keph) from the second ephemeral public key (gY) and the ephemeral private key (x); - calculating the permanent key (Kperm) from the public key of the second device (gb) and its own private key (a); 5 - verifying the first value (H(gy, Keph, Kperm, IDb)); - calculating a second value (H(gx, Keph, Kperm, IDa)) from the first ephemeral public key (gx), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDa); - sending the second value (H(gx, Keph, Kperm, IDa)) to the second device; and 10 - calculating a session key (Ksess) as a function of the ephemeral shared key (Keph).

3. A second device for participating, with a first device, in the calculation of a shared session key, the second device having a certificate (Cb) comprising a 15 public key (gb) and an identity corresponding to itself (IDb), and knowledge of the identity corresponding to itself (IDb), a private key (b), and the public key (gb), the second device comprising a processor for: - receiving a certificate of the first device (Ca) and a first ephemeral public key 20 (gx), the certificate comprising a public key (g') and an identity of the first device (IDa); - verifying the certificate of the first device (Ca); - choosing an ephemeral private key (y); - calculating a second ephemeral public key (gY); 25 - calculating an ephemeral shared key (Keph) from the first ephemeral public key (g') and the ephemeral private key (y); - calculating a permanent key (Kperm) from the public key of the first device (ga) and its own private key (b); - calculating a first value (H(gy, Keph, Kperm, IDb)) from the second ephemeral 30 public key (gY), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to itself (IDb); - sending its certificate (Cb), the second ephemeral public key (gY) and the first value (H(gy, Keph, Kperm, IDb)) to the first device; - receiving a second value (H(gx, Keph, Kperm, IDa)) from the first device, the 35 second value being calculated from the first ephemeral public key (gX), the ephemeral shared key (Keph), the permanent key (Kperm), and the identity corresponding to the first device (IDa); - verifying the second value (H(g", Keph, Kperm, IDa)); and - calculating the session key (Ksess) as a function of the ephemeral shared 5 key (Keph).

4. A method of calculating a session key shared by a first and a second device according to claim 1 substantially as hereinbefore described with reference to the accompanying drawings. 10

5. A first device according to claim 2 substantially as hereinbefore described with reference to the accompanying drawings.

6. A second device according to claim 3 substantially as hereinbefore 15 described with reference to the accompanying drawings. 11